Malware Analysis Report

2024-10-23 21:24

Sample ID 240804-vcxhtazejn
Target Solara.exe
SHA256 6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf
Tags
office04 quasar discovery spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf

Threat Level: Known bad

The file Solara.exe was found to be: Known bad.

Malicious Activity Summary

office04 quasar discovery spyware trojan

Quasar family

Quasar RAT

Quasar payload

Checks computer location settings

Executes dropped EXE

Drops file in System32 directory

Unsigned PE

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Scheduled Task/Job: Scheduled Task

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-04 16:51

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-04 16:51

Reported

2024-08-04 16:51

Platform

win7-20240705-en

Max time kernel

36s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Solara.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Users\Admin\AppData\Local\Temp\Solara.exe N/A
File opened for modification C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Users\Admin\AppData\Local\Temp\Solara.exe N/A

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2864 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\schtasks.exe
PID 2864 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\schtasks.exe
PID 2864 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\schtasks.exe
PID 2864 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2864 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2864 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2104 wrote to memory of 2764 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2104 wrote to memory of 2764 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2104 wrote to memory of 2764 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2104 wrote to memory of 2604 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2104 wrote to memory of 2604 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2104 wrote to memory of 2604 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2604 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2604 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2604 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2604 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2604 wrote to memory of 2756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2604 wrote to memory of 2504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2604 wrote to memory of 2504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2604 wrote to memory of 2504 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2504 wrote to memory of 2712 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2504 wrote to memory of 2712 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2504 wrote to memory of 2712 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2504 wrote to memory of 2900 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2900 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2504 wrote to memory of 2900 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2900 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2900 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2900 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2900 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2900 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2900 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2900 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2900 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2900 wrote to memory of 1584 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 1584 wrote to memory of 316 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 1584 wrote to memory of 316 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 1584 wrote to memory of 316 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 1584 wrote to memory of 2224 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 1584 wrote to memory of 2224 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 1584 wrote to memory of 2224 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2224 wrote to memory of 576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2224 wrote to memory of 576 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2224 wrote to memory of 2208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2224 wrote to memory of 2208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2224 wrote to memory of 2208 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2224 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2224 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2224 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2412 wrote to memory of 1028 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2412 wrote to memory of 1028 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2412 wrote to memory of 1028 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\schtasks.exe
PID 2412 wrote to memory of 832 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2412 wrote to memory of 832 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2412 wrote to memory of 832 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 832 wrote to memory of 2848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 832 wrote to memory of 2848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 832 wrote to memory of 2848 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 832 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 832 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 832 wrote to memory of 2840 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Solara.exe

"C:\Users\Admin\AppData\Local\Temp\Solara.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\CT6bXt5CxLas.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\WIxghe6J72A2.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\zQzrVRLuH4Ji.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\dg1ilPiU5AO4.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 nohchy-47404.portmap.host udp

Files

memory/2864-0-0x000007FEF65F3000-0x000007FEF65F4000-memory.dmp

memory/2864-1-0x0000000000DA0000-0x00000000010C4000-memory.dmp

memory/2864-2-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

C:\Windows\System32\SubDir\SolaraExecutor.exe

MD5 3cf4f19b7c69135acb3c4c9bb9cdfb90
SHA1 e2b5a40dd2abfa03671fde7c4e74f9b2846f989f
SHA256 6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf
SHA512 4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

memory/2864-7-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

memory/2104-8-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

memory/2104-9-0x00000000011B0000-0x00000000014D4000-memory.dmp

memory/2104-10-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CT6bXt5CxLas.bat

MD5 72784a64b54490cf9ffbc141a8b703c4
SHA1 af9a995f006f512291557ceb6585411941171398
SHA256 3a7a32da0359cb46da4fc2310d2d73911ebf62ec6d499361dba9c4ce9ff7c6dd
SHA512 ddc1c27522f0e6a4c79c34b86d81ced9696face7f0d2112c05ac827c227959ca6eee8ff21f6270a3ccf9733b1b489b2e8ae1638d83568b8a919555325c1050cc

memory/2104-19-0x000007FEF65F0000-0x000007FEF6FDC000-memory.dmp

memory/2504-22-0x0000000000050000-0x0000000000374000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WIxghe6J72A2.bat

MD5 fb193cbcd311baec3e9695fa7f5640a3
SHA1 93d2fa858588e5a91d65572ae33680a0cbbe7d52
SHA256 fadf49cca7a3f97a3073ce268dc9b79e97c5dda71c9777b0ca5cd450198c21e4
SHA512 151d781d6ad516e9e021961adc5b0f9a3327369924e658c606035eddd8fcbfc2e83e3497dce22f02be4c4a7e96fa68fde3c2551e65add7e80435186bda50ffed

memory/1584-33-0x0000000000A70000-0x0000000000D94000-memory.dmp

\??\PIPE\lsarpc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\zQzrVRLuH4Ji.bat

MD5 ed31c75270cd65af903344433d60dfc6
SHA1 3f30eeb1f05f76146d0252e796e5c9f28c215e86
SHA256 5fce4e4297baf948fca351365ecb09a848d02676967a754459995e9a6048fef3
SHA512 c6e11d14a3f0255585bf940600cad03d5098637599fd48adc22e19e1f8c9624446fd94e560cb14521962bceac0b05dcb2d44cff7c79b1ffbe38da5c09a1839c5

memory/2412-45-0x0000000000B50000-0x0000000000E74000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\dg1ilPiU5AO4.bat

MD5 87ef57f858c352289f7abdc012e205e1
SHA1 33aea67f466be2ade4dc177e9fb467f15a916899
SHA256 cb13ff6c981929279123c8ca13f2cfba14d8d17dcfe5b7a627771f3376240298
SHA512 33390cfaad0eaa9c0126f36acaa689061540b0ba8025de91ff741c8784d8158a9c1952ba34e59a983752cbb69c5e79a629fa63e121eddd3dbd96596e1189a0ed

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-04 16:51

Reported

2024-08-04 16:51

Platform

win10v2004-20240802-en

Max time kernel

33s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Solara.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Windows\system32\SubDir\SolaraExecutor.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Users\Admin\AppData\Local\Temp\Solara.exe N/A
File opened for modification C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Users\Admin\AppData\Local\Temp\Solara.exe N/A

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\SubDir\SolaraExecutor.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4960 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4960 wrote to memory of 4332 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4960 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 4960 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\Solara.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 232 wrote to memory of 2668 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe
PID 232 wrote to memory of 2668 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe
PID 232 wrote to memory of 2748 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 232 wrote to memory of 2748 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2748 wrote to memory of 3232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2748 wrote to memory of 3232 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2748 wrote to memory of 3860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2748 wrote to memory of 3860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2748 wrote to memory of 4144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2748 wrote to memory of 4144 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 4144 wrote to memory of 4752 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4144 wrote to memory of 4752 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4144 wrote to memory of 2820 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 4144 wrote to memory of 2820 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 2820 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2820 wrote to memory of 448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2820 wrote to memory of 4812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2820 wrote to memory of 4812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 2820 wrote to memory of 3168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 2820 wrote to memory of 3168 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 3168 wrote to memory of 4628 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3168 wrote to memory of 4628 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe
PID 3168 wrote to memory of 4676 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 3168 wrote to memory of 4676 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\system32\cmd.exe
PID 4676 wrote to memory of 332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4676 wrote to memory of 332 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 4676 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 4676 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\PING.EXE
PID 4676 wrote to memory of 4968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 4676 wrote to memory of 4968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\SubDir\SolaraExecutor.exe
PID 4968 wrote to memory of 3636 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4968 wrote to memory of 3636 N/A C:\Windows\system32\SubDir\SolaraExecutor.exe C:\Windows\SYSTEM32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\Solara.exe

"C:\Users\Admin\AppData\Local\Temp\Solara.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6ROHiET42FcS.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fWlkQLIJg1Gk.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h2E6UD4IKvcY.bat" "

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Windows\system32\SubDir\SolaraExecutor.exe

"C:\Windows\system32\SubDir\SolaraExecutor.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks" /create /tn "RtkAudUService64" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SolaraExecutor.exe" /rl HIGHEST /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fsXrOeSVWF5l.bat" "

C:\Windows\system32\chcp.com

chcp 65001

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 nohchy-47404.portmap.host udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 nohchy-47404.portmap.host udp
US 8.8.8.8:53 nohchy-47404.portmap.host udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 nohchy-47404.portmap.host udp

Files

memory/4960-0-0x00007FFA7F9B3000-0x00007FFA7F9B5000-memory.dmp

memory/4960-1-0x00000000001A0000-0x00000000004C4000-memory.dmp

memory/4960-2-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

C:\Windows\system32\SubDir\SolaraExecutor.exe

MD5 3cf4f19b7c69135acb3c4c9bb9cdfb90
SHA1 e2b5a40dd2abfa03671fde7c4e74f9b2846f989f
SHA256 6aabee552a530d63bdabc02cbe5714fcb7e1f9c826acb0b27ad267d50065cdaf
SHA512 4b4237eaf8ca42456b5ce183c83ba3f0cd382dfa5ae775a9433db4f7091ac0295267e80fcd93861a1022288ebf7c3a9d3b7caa07423f75c0b685812bf97996cd

memory/232-8-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

memory/4960-9-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

memory/232-10-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

memory/232-11-0x000000001C1D0000-0x000000001C220000-memory.dmp

memory/232-12-0x000000001C2E0000-0x000000001C392000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6ROHiET42FcS.bat

MD5 1bafa3c591b129c6a61e4f0ca5f8e490
SHA1 4e38e209563ffe58460f66cb72e2af2f0614910f
SHA256 1bae0cd6f2ce8a62e530ee35e5001985142540f55ac9b02ba32e94911375eef5
SHA512 c1a57a411095c8250a57c3e831eb209ca1423a78ff308070e522879c4869ffa8c96285f2d847898702ffc5308f9b9fcee1c39254f845ec48d99354528940166c

memory/232-18-0x00007FFA7F9B0000-0x00007FFA80471000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SolaraExecutor.exe.log

MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

C:\Users\Admin\AppData\Local\Temp\fWlkQLIJg1Gk.bat

MD5 bcabf8a1b8d7f802cd9f301120ca6f97
SHA1 5a8bcdb5621ea7c1294a893cc1599153f1cb617a
SHA256 7007c19e4f70d5c20ea7dc2a5829211de20531e853e0210f97216c92494dc8cd
SHA512 d4ea871a8130a1613c008bba7f0c346079d30e7466964b6d96e7d24827b9fb6d07f535c359f514be7703dc0d5665ef54854369690da1766205391a0dcb108637

C:\Users\Admin\AppData\Local\Temp\h2E6UD4IKvcY.bat

MD5 c20b910c00a2c4e9257b9496d00eac2f
SHA1 2e8a8db0b8c422cf3e6a2771932779e921a9a78e
SHA256 fd3243cc779803fa7b85895a3b204f116a50f0c8d92414ff6fbea9d9089cfe97
SHA512 7845b6455844b71e4e26e179fd6da438fb285d2b289294807ddb6946ff707093053ff9639192503007abc839b8abfef6139161e3f23efe95e6fa9b581f4bbe94

C:\Users\Admin\AppData\Local\Temp\fsXrOeSVWF5l.bat

MD5 4d1b203483cc980460a9da61bff80cc7
SHA1 20f26c0423cd2fe545f1da13f2d9befa2e9164ae
SHA256 5e7d8f0600258fcaa2dc30657c7b1a6a7fc91c37b3da5a120624523dde05074b
SHA512 8c14b216c915d8a7c3e154794a9ecf789dc44ca6b62a22400062b0f77e416f74c82b3153e5a3f11a613f7d139854de8dad5e47b272357b88bc64d1ad874ffa35